CSS Escapes Email Sandbox to Capture Credentials in Six Major Webmail Platforms
Security researcher Gareth Heyes of PortSwigger Web Security presented groundbreaking research at Black Hat USA 2026 revealing that CSS and HTML within email content can escape message rendering boundaries and interact with webmail interface controls — allowing attackers to capture passwords typed by recipients, steal session tokens, and leak IP addresses without the recipient suspecting anything is wrong.
The research affects six major webmail platforms: Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. Some vulnerabilities remained unpatched at the time of public disclosure on August 6, 2026.
The Attack Techniques
1. Password Capture via Label-Jacking (Outlook + Firefox)
The most alarming attack uses an HTML label element within the email to masquerade as a password field in the webmail interface itself. When a recipient views the malicious email in Outlook on Firefox, the label element hijacks the focus and captures keystrokes — including passwords — in real time as the user types them.
Attack Chain:
Malicious email → label element in body → binds to Outlook password field
→ User types password → keystrokes captured → exfiltrated to attacker
This technique exploits a fundamental design assumption: that HTML within an email cannot bind to elements outside the email body. The label-jacking attack violates that assumption without any JavaScript — using only HTML and CSS.
Status: Remained active at time of publication (August 6, 2026).
2. Token Exfiltration via Paste-Timing Attack (Yahoo Mail + AOL)
Yahoo Mail and AOL Mail are vulnerable to a paste-timing attack that exploits how Firefox processes pasted HTML content before sanitization runs. By carefully timing when CSS rules are evaluated relative to paste events, an attacker's crafted email can reconstruct enough information to extract authentication tokens from the webmail session.
This is a subtle race-condition-class vulnerability — it requires no user error beyond reading a malicious email.
3. Image-Set Exfiltration + Prompt Injection (Gmail)
Gmail's sanitization blocks most direct data exfiltration, but the image-set() CSS function can be used to make outbound requests even after sanitization. When combined with connected services (demonstrated using prompt injection against AI assistant integrations), the attack can:
- Trigger token confirmation emails from connected services
- Intercept and extract credentials through the connected account's reply path
This demonstrates a new class of attack: CSS-initiated prompt injection in AI-enhanced webmail environments.
4. IP Address Leak via Tracker Protection Bypass (Proton Mail)
Proton Mail's tracker protection — designed to prevent image beacons from revealing recipients' IP addresses — can be bypassed. The bypass allows an attacker to:
- Determine the precise IP address of the email recipient
- Identify the exact time the email was opened
- Correlate multiple email opens to build a timing fingerprint
Status: Proton's proxy bypass no longer functioned at time of publication; Proton appears to have silently patched it.
Affected Platforms and Status
| Platform | Vulnerability | Status at Publication |
|---|---|---|
| Outlook | Label-jacking password capture | UNPATCHED |
| Gmail | image-set() bypass + prompt injection | UNPATCHED |
| Yahoo Mail | Paste-timing token exfiltration | Under investigation |
| AOL Mail | Paste-timing token exfiltration | Under investigation |
| Fastmail | Two CSS mutation bugs | PATCHED |
| Proton Mail | Tracker protection bypass | PATCHED |
Why This Is Significant
Email HTML sanitization has long been treated as a solved problem — webmail providers invest heavily in stripping dangerous content before rendering. This research demonstrates that even well-implemented sanitization can fail when:
- CSS interacts with the surrounding DOM beyond the email boundary
- Timing side-channels expose data during sanitization processing
- Feature interactions between CSS, browser behavior, and connected services create unexpected attack surfaces
- AI integrations introduce new prompt injection vectors reachable via CSS-initiated requests
The attacks require no JavaScript, operate within standard HTML and CSS feature sets, and exploit browser and webmail interactions that no sanitization engine was designed to anticipate.
Mitigations
For End Users
- Use a dedicated browser for webmail rather than your primary browser — reduces cross-domain data exposure
- Do not type passwords while an email is open in the same browser tab
- Use hardware security keys (FIDO2/WebAuthn) — immune to password capture attacks
- Use email clients (Thunderbird, Apple Mail) rather than webmail where possible — desktop clients do not share a DOM with the rest of the interface
- Consider plaintext email for high-security communications
For Webmail Providers
Heyes recommends the following mitigations:
| Mitigation | Benefit |
|---|---|
| Sandboxed iframes for email rendering | Complete DOM isolation — no label binding across boundary |
| Strict CSS restrictions | Block image-set() and dangerous selectors |
Block select menus in email HTML | Removes UI hijacking vectors |
| Custom attribute validation | Prevent binding to interface elements |
| Content Security Policy for email frames | Restrict outbound request paths |
Responsible Disclosure
Gareth Heyes reported these vulnerabilities to affected vendors prior to the Black Hat USA 2026 presentation. Fastmail and Proton Mail issued fixes before the public disclosure. Google, Microsoft, Yahoo, and AOL received reports and were given time to remediate — some issues remained open at publication.
The full research will be detailed in a PortSwigger blog post. Conference slides from the Black Hat presentation contain technical demonstrations of each attack chain.
References
- The Hacker News — New CSS Attacks Can Break Webmail Defenses
- PortSwigger Research — Gareth Heyes
- Black Hat USA 2026 — Briefings Schedule